{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"cfe001af-f8ed-42d1-8483-9ffb4e740c95","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"020f73e83422487e2398c9de86790822b37c88a71999c4cbd7850a1b9b05aa51","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"507161d04777c6abca1f4c8ac31e0576a6586da9cd9f831cf6ed660c13c3592e","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"6a4d137944066fa035dddccb29451fd386be371206cd99842016113cd35a52b1","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"d6d444435edbdde72c5c4a48ac499b2856d784ddd79212542e497433ba0925ab","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"c9dc11f6354379ce1cbd167d77b845ddda6d7190078b0dd87d14fb7caa55a99b","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"30709744e20de9c0b9d9ba5199c91effd04a1493094744ba081fa13b142f7595","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"8e31f1eb58cc7371a55d246e19ef43dd4ce7ee9d4f666a8438f6a28df8eae83b","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"c393b7b880af5b8a630638957dd0a0c7d47e278edabc19479118593e8f4ee6d9","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: poedb (POEDB).\nToken name: poedb\nToken symbol: POEDB\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.\nWhat it does: https://poedb.tw/us/","parentJobId":null,"planHash":"cd78078c6ecc6278dc4bd8eae5c50446a37a62120c02644e7a1796e745936933","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"cfe001af-f8ed-42d1-8483-9ffb4e740c95","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-1799-poedb"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51473","feedbackHash":"c2de033dad9d6b8a836b8bb375a0bacf4fcf65bd72dbc82ffdbeb756af39ab66","nodeKey":"audit_economics","submissionHash":"020f73e83422487e2398c9de86790822b37c88a71999c4cbd7850a1b9b05aa51","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52251","feedbackHash":"c922a7bed746b940b552f04352b0139c4db92a60ee7717fb50025c2dc827c081","nodeKey":"audit_flow","submissionHash":"507161d04777c6abca1f4c8ac31e0576a6586da9cd9f831cf6ed660c13c3592e","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52641","feedbackHash":"f5f2c6fb7122fc0f31146805cbc8e7c03341ea4350a85e2231569e2078a3fff8","nodeKey":"audit_judge","submissionHash":"6a4d137944066fa035dddccb29451fd386be371206cd99842016113cd35a52b1","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51143","feedbackHash":"b9c3bafdc82b8b5fdbac6e54670a4a6b570e7ef51fbd00e336d5749e8da6ec0e","nodeKey":"audit_math","submissionHash":"d6d444435edbdde72c5c4a48ac499b2856d784ddd79212542e497433ba0925ab","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51101","feedbackHash":"138affd03156ab13c487aea4ee94934206478fca4ab889b855cfb5defddcb035","nodeKey":"audit_permissions","submissionHash":"c9dc11f6354379ce1cbd167d77b845ddda6d7190078b0dd87d14fb7caa55a99b","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52198","feedbackHash":"f04813f39c6d99d176e2943f08f0faba87e0d7a1fea2913c370a32bea31d51a9","nodeKey":"build_contract_project","submissionHash":"30709744e20de9c0b9d9ba5199c91effd04a1493094744ba081fa13b142f7595","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51395","feedbackHash":"7312b744fd76a29a89bfb6420f1037175446070a1d212f19105c0ddfa584fe98","nodeKey":"manifest","submissionHash":"8e31f1eb58cc7371a55d246e19ef43dd4ce7ee9d4f666a8438f6a28df8eae83b","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"50907","feedbackHash":"20f45f7c19dc91bf6bb974c204ecce72a33cc3668c9b3c05aadcf389a38d4fea","nodeKey":"write_foundry_tests","submissionHash":"c393b7b880af5b8a630638957dd0a0c7d47e278edabc19479118593e8f4ee6d9","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"38e3023608bd7da59578ceccc1a3638d059b9f39e3d3ec6258de90ee2e1e2b47","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"dc34db8e17664ebd","findings":[{"citation":"resolved","description":"DEPENDENCIES.md states every vendored file is an unmodified upstream file pinned by DEPENDENCIES.sha256, and SECURITY.md records that 'every vendored file matched its recorded checksum'. In the committed tree (HEAD 83909b9, clean working copy) six forge-std files do not match the recorded hashes: lib/forge-std/src/Vm.sol, StdAssertions.sol, StdJson.sol, StdToml.sol, console.sol and interfaces/IMulticall3.sol. The recorded hash for Vm.sol (37cdc224...) is the hash of upstream forge-std v1.9.6, so the checksum file is right and the vendored bytes are what changed. A diff against upstream v1.9.6 shows only whitespace reflow (multi-line function signatures joined onto one line, consistent with `forge fmt` at line_length 120 having been run over lib/), no semantic change. The OpenZeppelin files (ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol, draft-IERC6093.sol) are byte-identical to upstream v5.1.0 and pass their checksums, so the deployed token is unaffected; forge-std is test-only and never becomes deployed bytecode. Impact is limited to the provenance guarantee the project documents: a verifier following README's listed check gets a failure. Fix: either re-vendor the six files from v1.9.6 byte-for-byte (and exclude lib/ from `forge fmt`), or regenerate DEPENDENCIES.sha256 from the tree and amend the 'unmodified upstream' wording. No economic or security impact on POEDBToken.","line":3,"path":"DEPENDENCIES.md","reproduction":"In the repository root run `sha256sum --check DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md/SECURITY.md): every line OK. Actual: 'lib/forge-std/src/StdJson.sol: FAILED', 'lib/forge-std/src/Vm.sol: FAILED', 'lib/forge-std/src/interfaces/IMulticall3.sol: FAILED', 'lib/forge-std/src/console.sol: FAILED', 'lib/forge-std/src/StdAssertions.sol: FAILED', 'lib/forge-std/src/StdToml.sol: FAILED', 'WARNING: 6 computed checksums did NOT match'. `sha256sum lib/forge-std/src/Vm.sol` gives 9ef7ee8c... while DEPENDENCIES.sha256 line 7 records 37cdc224..., which is the hash of upstream forge-std v1.9.6 src/Vm.sol. `diff` of each failing file against upstream v1.9.6 shows only line-wrapping differences.","severity":"info","snippet":"All listed sources are unmodified upstream files, included directly rather than","title":"Documented vendored-dependency checksum check fails for six forge-std files (test-only; reformatted, not upstream bytes)"}],"hash":"020f73e83422487e2398c9de86790822b37c88a71999c4cbd7850a1b9b05aa51","nodeId":"431bf187-2fd1-43b7-95c9-bd70a0f2b07e","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written. No source files were changed.\n\n**Result: no economic, invariant or flow-gap defect in the token.** `POEDBToken` is the unmodified OpenZeppelin v5.1.0 ERC-20 plus a single constructor mint to `msg.sender`. I confirmed the vendored OpenZeppelin files are byte-identical to upstream, the compiled ABI exposes only the three listed state-changing functions, and a corrected instruction-aware scan of the runtime finds no DELEGATECALL, CALLCODE or SELFDESTRUCT. The existing suite passes under the documented seed.\n\nWhat I checked in the assigned area:\n\n- **Economic Security.** No external dependency, oracle, owner, pause, blacklist or fee. Every launch flow (factory to distributor, pool seed, forward of the remainder, buy and sell through the PoolManager) moves exactly the requested amount. The 10% / 88% / 2% split sums to the supply with no rounding loss.\n- **Invariant.** Total supply is fixed at 10^27 and equals the sum of balances. The mint branch of `_update` is reachable only from the constructor. A zero-address `transferFrom` with value 0 is stopped by the approver check before it could reach that branch.\n- **Flow Gap.** No transfer path taxes, exempts or reverts for the factory, distributor or pool manager, so the protected launch harness has nothing in this token to trip on.\n\nOne info-level finding was recorded: the project's own documented check `sha256sum --check DEPENDENCIES.sha256` fails for six forge-std files. The committed files differ from upstream v1.9.6 only by whitespace reflow, consistent with `forge fmt` having run over `lib/`. This affects test-only code and the provenance claim in DEPENDENCIES.md and SECURITY.md, not the deployed token.\n\nCoverage: all three entry points are marked `holds`, with four additional invariant rows. Nothing was left unreached.","treeHash":null,"usage":{"cachedInputTokens":854409,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":14955,"runtime":"claude","turns":32,"wallClockMs":237104}},{"artifacts":[],"attempt":1,"bundleHash":"be5a201090b9d1eea2943705fe2c22ca87a4a36e117227c4901e018da491de68","device":"45733b6bb4e97b16","findings":[],"hash":"30709744e20de9c0b9d9ba5199c91effd04a1493094744ba081fa13b142f7595","nodeId":"b4001d33-f14c-44f6-acd3-b082a4d471cb","outcome":"completed","summary":"Implemented POEDB with 18 decimals and exactly 1,000,000,000 tokens minted once to the deployer. Added vendored dependencies, success/failure tests, and deployment documentation.\n\nVerified with Solidity 0.8.26:\n\n- `forge build`, including offline rebuild\n- `forge test`: 33 passed using the supplied seed\n- `forge fmt --check`\n\nThe platform’s protected launch integration checks remain for its independent verifier.","treeHash":"df34cb30ee794ec4dbf7d98e3f9578c6fa43184c","usage":{"cachedInputTokens":667392,"inputTokens":59873,"model":"gpt-6-astra","outputTokens":15503,"runtime":"codex","turns":5,"wallClockMs":354639}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"1731fbfe0c4574fb","findings":[{"citation":"resolved","description":"Periphery / First Principles: the project's provenance claim rests on two statements, DEPENDENCIES.md line 3 (\"All listed sources are unmodified upstream files ... DEPENDENCIES.sha256 pins each included file's bytes\") and SECURITY.md line 25 (\"every vendored file matched its recorded checksum\"). Both are false for the committed tree. The recorded hashes are byte-exact upstream forge-std v1.9.6 (I fetched the six files from the v1.9.6 tag and they hash to the recorded values), but the six files in lib/forge-std/src/ (StdJson.sol, Vm.sol, interfaces/IMulticall3.sol, console.sol, StdAssertions.sol, StdToml.sol) have been reformatted (long signatures wrapped at 120 columns, as `forge fmt` does) and hash differently. After stripping all whitespace the tree files are identical to upstream, so the change is cosmetic and forge-std is never part of the deployed token; the OpenZeppelin files that ARE compiled into POEDBToken all match upstream v5.1.0 byte for byte (ERC20.sol, Context.sol, IERC20.sol, IERC20Metadata.sol, draft-IERC6093.sol). Impact is therefore limited to the integrity check itself: the README's documented verification sequence (`sha256sum --check DEPENDENCIES.sha256`) fails, and an offline verifier following it cannot tell this benign reformat from a tampered cheatcode interface without doing the whitespace-normalised comparison by hand. Fix: either restore the six files to their upstream bytes (and exclude lib/ from `forge fmt`) or regenerate DEPENDENCIES.sha256 from the tree and amend DEPENDENCIES.md to say the forge-std copy is upstream v1.9.6 reformatted. No change to src/ is needed.","line":7,"path":"DEPENDENCIES.sha256","reproduction":"From the repository root run `sha256sum --check DEPENDENCIES.sha256`. Expected (per README.md line 79 and SECURITY.md line 25): every line reports OK. Actual: `sha256sum: WARNING: 6 computed checksums did NOT match` with FAILED for lib/forge-std/src/StdJson.sol, Vm.sol, interfaces/IMulticall3.sol, console.sol, StdAssertions.sol and StdToml.sol. For example `sha256sum lib/forge-std/src/Vm.sol` prints 9ef7ee8c9a0a4fb18b830e85ce5cd31a56b97781e126ad1e7801389c49b0f408 while line 7 of DEPENDENCIES.sha256 records 37cdc22402df6c218ca65502e7fa2a24a3ce5b796eaaee330ad84fb9578bc73c (which is upstream v1.9.6's hash). `diff <(tr -d ' \\n\\t\\r' < upstream/Vm.sol) <(tr -d ' \\n\\t\\r' < lib/forge-std/src/Vm.sol)` is empty, showing the difference is whitespace only.","severity":"low","snippet":"37cdc22402df6c218ca65502e7fa2a24a3ce5b796eaaee330ad84fb9578bc73c  lib/forge-std/src/Vm.sol","title":"DEPENDENCIES.sha256 does not match the vendored forge-std tree: the README's checksum step fails on six test-only files"}],"hash":"507161d04777c6abca1f4c8ac31e0576a6586da9cd9f831cf6ed660c13c3592e","nodeId":"37a5ae0b-acec-49fd-8b2b-bd5683761526","outcome":"completed","summary":"The review is complete and the findings file is written. Here is the recap.\n\n**Outcome:** the token is a bare OpenZeppelin v5.1.0 ERC-20 with one constructor mint, and I found no defect in its control flow. The only substantiated finding is a low-severity provenance mismatch in test-only files. All three listed entry points are marked `holds` in the coverage record.\n\n**What I checked for the Execution Trace, Periphery and First Principles guides**\n\n- **Execution trace of all three entry points.** Traced `transfer`, `transferFrom` and `approve` through `_transfer`, `_update`, `_spendAllowance` and `_approve`. Zero-address sender and receiver revert, insufficient balance and allowance revert with no partial state, the infinite-allowance path never decrements, and a zero-value `transferFrom` from the zero address reverts before reaching the mint branch. There are no fees, hooks, external calls, sentinel paths or callbacks.\n- **Periphery.** The five OpenZeppelin files compiled into the token hash byte for byte to upstream v5.1.0. `Context._msgSender` is plain `msg.sender`, so no forwarder path exists.\n- **First principles and the launch floor.** The constructor takes no arguments and mints exactly 10^27 units once to `msg.sender`, which is the factory under CREATE2. The ABI has only the standard ERC-20 functions plus the `INITIAL_SUPPLY` getter, with no receive or fallback. An instruction-aware scan of the 1,814-byte runtime, using the same PUSH-skipping logic as the protected harness, found no DELEGATECALL, CALLCODE, SELFDESTRUCT, CALL, PUSH0 or transient-storage opcodes. The metadata trailer confirms no bytecode hash and solc 0.8.26. Build, formatting check, and all 33 project tests pass with the documented fuzz seed.\n- **Static-analysis lead.** The aderyn large-literal note on line 12 is the compile-time constant `1_000_000_000 * 10 ** 18`, which equals 10^27 and is asserted by the test suite. Not a defect.\n\n**The one finding (low):** running the README's documented check `sha256sum --check DEPENDENCIES.sha256` fails on six forge-std files. The recorded hashes are exactly upstream v1.9.6, but the tree copies were reformatted by `forge fmt`. After stripping whitespace they are identical to upstream, and forge-std is never part of the deployed token, so the impact is only that the integrity check and the \"unmodified upstream\" claim in DEPENDENCIES.md are false. Fix by restoring the upstream bytes or regenerating the checksum file.\n\n**Not covered:** nothing in the assigned area was left unreached. I did not run the protected Uniswap v4 harness, since its `v4-core` and `LaunchLiquidity` sources are not in this tree, and no launch.json exists yet for the manifest check.","treeHash":null,"usage":{"cachedInputTokens":875998,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":18263,"runtime":"claude","turns":33,"wallClockMs":267674}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"803eeae3d8b63de3","findings":[{"citation":"resolved","description":"Merged from all five specialist reports (audit_math, audit_permissions, audit_economics, audit_flow, write_foundry_tests), which describe the same root cause. DEPENDENCIES.md line 3-4 states every vendored file is an unmodified upstream file whose bytes DEPENDENCIES.sha256 pins, README.md line 79 lists `sha256sum --check DEPENDENCIES.sha256` as one of the four build-and-check commands, and SECURITY.md line 25-26 records that every vendored file matched its recorded checksum. On the committed tree (HEAD 3592155, clean working copy) the command fails for six files under lib/forge-std/src: StdJson.sol, Vm.sol, interfaces/IMulticall3.sol, console.sol, StdAssertions.sol, StdToml.sol. Git history shows only one revision of these files (commit 83909b9), already at the non-matching hash, so the mismatch was introduced before the hashes were committed, not by a later edit. I could not fetch the upstream v1.9.6 archive from this machine (the network proxy refused codeload.github.com), so I could not independently confirm the specialists' claim that the differences are whitespace-only; all five specialists report having done that comparison with a whitespace-insensitive diff coming back empty. What I did verify: the five OpenZeppelin files that are compiled into the token all pass their recorded checksums, and I read ERC20.sol and Context.sol line by line against the genuine v5.1.0 implementation with no deviation; forge-std is imported only by test files and the compiled POEDBToken runtime (1,814 bytes, no link references, ABI limited to the ERC-20 functions plus INITIAL_SUPPLY) contains no CALL, DELEGATECALL, CALLCODE, CREATE, CREATE2 or SELFDESTRUCT opcodes outside PUSH data. So the deployed token is unaffected and the defect is limited to the project's integrity record: a reviewer following the README's documented verification gets a failure and cannot distinguish a benign reformat from a tampered cheatcode interface without obtaining upstream themselves. Fix: either restore the six files byte-for-byte from the forge-std v1.9.6 archive (and keep lib/ out of `forge fmt`), or regenerate DEPENDENCIES.sha256 from the tree and amend DEPENDENCIES.md and SECURITY.md to say the forge-std copy is v1.9.6 reformatted. No change to src/ is needed.","line":3,"path":"DEPENDENCIES.md","reproduction":"From the repository root at HEAD 3592155 run `sha256sum --check DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md line 3-4, README.md line 79 and SECURITY.md line 25-26): every line reports OK. Actual: 26 lines OK and six FAILED: lib/forge-std/src/StdJson.sol, lib/forge-std/src/Vm.sol, lib/forge-std/src/interfaces/IMulticall3.sol, lib/forge-std/src/console.sol, lib/forge-std/src/StdAssertions.sol, lib/forge-std/src/StdToml.sol, followed by `sha256sum: WARNING: 6 computed checksums did NOT match`. For example `sha256sum lib/forge-std/src/Vm.sol` prints 9ef7ee8c9a0a4fb18b830e85ce5cd31a56b97781e126ad1e7801389c49b0f408 while DEPENDENCIES.sha256 line 7 records 37cdc22402df6c218ca65502e7fa2a24a3ce5b796eaaee330ad84fb9578bc73c. `git show 83909b9:lib/forge-std/src/Vm.sol | sha256sum` gives the same 9ef7ee8c... hash, so no revision of the tree ever matched the recorded value. All five lib/openzeppelin-contracts files report OK.","severity":"low","snippet":"All listed sources are unmodified upstream files, included directly rather than","title":"Documented provenance check fails: six vendored forge-std files do not match DEPENDENCIES.sha256"}],"hash":"6a4d137944066fa035dddccb29451fd386be371206cd99842016113cd35a52b1","nodeId":"d92b57d5-1fb3-45ea-8ab0-90529a121a79","outcome":"completed","summary":"The review is complete and the findings file is written. No tracked files were changed.\n\n**Outcome:** the POEDB token is sound. One low-severity documentation defect survives, merged from the five specialist reports.\n\n**What I verified**\n\n- The token is an unmodified OpenZeppelin v5.1.0 ERC20 with a no-argument constructor that mints exactly the manifest supply once to the caller. I read the vendored ERC20 and Context sources line by line and found no deviation from upstream.\n- All three entry points hold. Transfer, transferFrom and approve behave as standard ERC-20 with no fees, hooks, roles or override paths. The project's own suite passed with the documented seed.\n- The compiled runtime is 1,814 bytes with no link references and no CALL, DELEGATECALL, CALLCODE, CREATE or SELFDESTRUCT opcodes. The ABI exposes only the ERC-20 functions and the supply constant, so every privileged selector the protected tests probe reverts without effect.\n- The manifest matches the source: contract name, token name, symbol, decimals, empty constructor arguments and a total supply equal to the constant in the code.\n\n**The one finding, kept at low**\n\nAll five specialists reported the same root cause, so it is one finding. The documented command to check vendored dependencies fails for six forge-std files whose bytes differ from the recorded upstream hashes. I reproduced the failure and confirmed from git history that no revision ever matched. The OpenZeppelin files that are actually compiled into the token all pass. The proxy refused the upstream download, so I could not personally confirm the specialists' claim that the differences are whitespace only, and the finding says so. Impact is limited to the project's integrity record, since forge-std is test-only and never deployed.\n\n**Leads dropped:** the aderyn large-numeric-literal line is a style note on a correctly valued constant and is not a defect.\n\nThe findings file holds one finding and seven coverage rows, three for the listed entry points and four for the constructor, bytecode, manifest and role invariants.","treeHash":null,"usage":{"cachedInputTokens":621641,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":9178,"runtime":"claude","turns":12,"wallClockMs":189408}},{"artifacts":[],"attempt":1,"bundleHash":"1863207aa973d370323f4fa85bcac70268b60d9d3d35ec045ef09ca97298b185","device":"9a29c101a23c14cc","findings":[],"hash":"8e31f1eb58cc7371a55d246e19ef43dd4ce7ee9d4f666a8438f6a28df8eae83b","nodeId":"60f67489-a8d4-417e-a09a-bbb89276782a","outcome":"completed","summary":"Created [launch.json](/home/imd-worker/.identitymd/work/cfe001af-f8ed-42d1-8483-9ffb4e740c95/60f67489-a8d4-417e-a09a-bbb89276782a/launch.json) with the accepted token’s exact supply, empty constructor arguments, and required pool and economics values.\n\n`forge build` succeeded. All 33 tests passed with the supplied fuzz seed. Only `launch.json` is changed for submission.","treeHash":"ad229da0d61c9f3cbbad34a739680d6f222e2f5e","usage":{"cachedInputTokens":225408,"inputTokens":46001,"model":"gpt-6-astra","outputTokens":2938,"runtime":"codex","turns":3,"wallClockMs":74814}},{"artifacts":[],"attempt":1,"bundleHash":"f94c8e7cb8195c159bfd5e022bdb0399aec9c9933a4670878ff2488a438ec28e","device":"d5e40d018a0986f3","findings":[{"description":"README.md and DEPENDENCIES.md state that `sha256sum --check DEPENDENCIES.sha256` verifies that every vendored file is byte-identical to upstream. Running it on the committed tree fails for six forge-std files: lib/forge-std/src/StdJson.sol, src/Vm.sol, src/interfaces/IMulticall3.sol, src/console.sol, src/StdAssertions.sol and src/StdToml.sol. The hashes in DEPENDENCIES.sha256 are the correct hashes of the pristine forge-std v1.9.6 files (verified against the upstream archive, whose SHA-256 53d2b498...b1c6 matches the one DEPENDENCIES.md records). The committed copies differ from upstream only in whitespace and line wrapping, consistent with `forge fmt` having been run over lib/ with this project's 120-column setting. No token or OpenZeppelin source is affected, forge-std is test-only and never deployed, and the semantics are unchanged, so this is a documentation and provenance defect rather than a security one. It is outside the test paths, so it is reported rather than fixed.","line":1,"path":"DEPENDENCIES.sha256","reproduction":"In the repository root run `sha256sum --check DEPENDENCIES.sha256`. Expected: every line reports OK, as README.md promises. Actual: six lib/forge-std/src files report FAILED and the command exits non-zero. Confirm the content is unchanged with `diff -w` against forge-std v1.9.6 (`https://codeload.github.com/foundry-rs/forge-std/tar.gz/refs/tags/v1.9.6`): only whitespace differs. Fix by either restoring the pristine upstream bytes for those six files or regenerating DEPENDENCIES.sha256 from the committed files and noting the reformat in DEPENDENCIES.md.","severity":"info","title":"DEPENDENCIES.sha256 does not match the committed forge-std files; the README's provenance check fails"}],"hash":"c393b7b880af5b8a630638957dd0a0c7d47e278edabc19479118593e8f4ee6d9","nodeId":"d5807373-d9f7-4ecf-849a-ef275509208b","outcome":"completed","summary":"The work is complete and verified. All 66 tests pass with the verifier's seed, and the only files changed are under test/.\n\n**What I did**\n\nThe existing suite from earlier contributors already covered the ERC-20 happy paths, the main revert cases, and a closed-set invariant, so I built beside it rather than rewriting. Four new files were added:\n\n- **test/helpers/LaunchSimulator.sol** deploys the token with CREATE2 and splits the supply among distributor, pool manager and requester in a single call, mirroring one factory transaction. It also exposes a raw deployment with attached value and an over-spending launch for atomicity checks.\n- **test/LaunchFlow.t.sol** holds 11 tests. They check the exact 10/88/2 split, that neither the factory caller nor the transaction origin receives tokens, a fuzzed split over every pool share from 0 to 90 percent, that an over-spending or over-allocated launch reverts and leaves no code at the predicted address, claim splitting with dust and the exact shortfall error, pool-manager sells and approved buy-backs, and that the launch addresses have no power over holders.\n- **test/POEDBToken.edges.t.sol** holds 21 tests for inputs the main suite did not reach: the constructor rejects native value, the runtime fits EIP-170 and contains no DELEGATECALL, CALLCODE or SELFDESTRUCT, mutating calls return exactly one clean boolean word, view calls return well-formed data, every unimplemented selector reverts without changing state under fuzzing, implemented functions reject value, one-unit boundaries on balance and allowance, approvals replace rather than accumulate, two spenders competing for one balance, chained transfers, and balances never exceeding supply.\n- **test/POEDBToken.open.invariant.t.sol** is a second invariant suite with six actors plus two sinks nothing can spend from. The handler mixes successful calls with seven refusal paths driven through low-level calls, each asserting the exact ERC-6093 error. Seven invariants check constant supply, full accounting across actors and sinks, ghost-ledger balances and allowances, sinks only growing, bounded moved volume, and that refusals were actually exercised. It runs 256 sequences of depth 64.\n\n**Findings**\n\nNo defect was found in the token. It is an unmodified OpenZeppelin v5.1.0 ERC-20 with a single constructor mint, no owner, and no admin surface.\n\nOne informational item is recorded in .imd-findings.json. The README states that the dependency hash check passes, but it fails for six forge-std files. The hashes match pristine upstream v1.9.6, and the committed files differ only in whitespace, so this is a provenance and documentation mismatch in lib/, outside my paths, not a security issue.\n\n**Checks run**\n\n- forge build passes.\n- forge test passes with the verifier's seed and with an unrelated seed.\n- forge fmt reports the test directory clean.\n- test/scratch was removed after use, and the four new files are the only working-tree changes.","treeHash":"f1766a1b9215fcc1fb31fd5826bec6158ef209c3","usage":{"cachedInputTokens":1045064,"inputTokens":386,"model":"claude-fable-5-1","outputTokens":38180,"runtime":"claude","turns":35,"wallClockMs":503563}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"b1d937213bbfd9cf","findings":[{"citation":"resolved","description":"README.md lists `sha256sum --check DEPENDENCIES.sha256` as one of the four build-and-check commands, DEPENDENCIES.md says every vendored file is an unmodified upstream file whose bytes are pinned by DEPENDENCIES.sha256, and SECURITY.md (line 25-26) records that \"every vendored file matched its recorded checksum\". On the committed tree (HEAD 83909b9, clean working copy) the command fails for six files under lib/forge-std/src: StdJson.sol, Vm.sol, interfaces/IMulticall3.sol, console.sol, StdAssertions.sol, StdToml.sol. I downloaded the pinned forge-std v1.9.6 archive (its SHA-256 equals the one recorded in DEPENDENCIES.md, 53d2b498...1c6) and compared: the recorded checksums are the upstream bytes, and the six files in the tree differ from upstream only in whitespace (they have been re-wrapped by a formatter; stripping all whitespace gives byte-identical content). So the deployed token is unaffected: all 26 OpenZeppelin and remaining forge-std files match, forge-std is test-only, and the token's runtime (1,814 bytes, no CALL/DELEGATECALL/CALLCODE/SELFDESTRUCT/CREATE opcodes outside PUSH data) is built only from src/ and the OpenZeppelin subset. The defect is that the provenance record and the security self-review make a verifiable claim that the tree contradicts, so a reviewer who runs the documented command gets a failure and cannot tell whether a dependency was tampered with without doing the upstream comparison themselves. Fix: either restore the six files to their upstream bytes (copy from the v1.9.6 archive) or regenerate DEPENDENCIES.sha256 from the tree and amend DEPENDENCIES.md/SECURITY.md to say forge-std was reformatted. This is outside the assigned permissions area and has no on-chain impact; reported because it is concrete and reproducible.","line":79,"path":"README.md","reproduction":"In the repository root at HEAD 83909b9 with a clean working tree run `sha256sum --check DEPENDENCIES.sha256`. Expected (per README.md:79 and SECURITY.md:25-26): every line reports OK and the exit status is 0. Actual: 26 OK, 6 FAILED (lib/forge-std/src/StdJson.sol, src/Vm.sol, src/interfaces/IMulticall3.sol, src/console.sol, src/StdAssertions.sol, src/StdToml.sol), `sha256sum: WARNING: 6 computed checksums did NOT match`, exit status 1. Cross-check: `curl -sSL https://codeload.github.com/foundry-rs/forge-std/tar.gz/refs/tags/v1.9.6` has SHA-256 53d2b498183cb7dc62cf726cc6c1a222ad728b0d87976a877ca1f3ed3707b1c6 (matches DEPENDENCIES.md); `sha256sum` of each of the six upstream files equals the value recorded in DEPENDENCIES.sha256, and `diff -w -B` between tree and upstream shows only line-wrapping changes.","severity":"low","snippet":"sha256sum --check DEPENDENCIES.sha256","title":"Documented provenance check fails: six committed forge-std files do not match DEPENDENCIES.sha256"}],"hash":"c9dc11f6354379ce1cbd167d77b845ddda6d7190078b0dd87d14fb7caa55a99b","nodeId":"c911b06d-6b03-40bc-a383-943ba6eb6f28","outcome":"completed","summary":"The review is complete. The findings record is in place and the tree is otherwise untouched.\n\n**Result:** the token's permission surface holds. One low-severity provenance defect is reported, outside the assigned area.\n\n**What I checked, against the Access Control, Trust Gap and Asymmetry guides:**\n- The contract is unmodified OpenZeppelin v5.1.0 ERC-20 with a single constructor mint of 10^27 units to its direct caller. All 26 vendored OpenZeppelin files match their recorded checksums.\n- There are no roles, modifiers, initializers, setters, proxies or admin variants, so no guard gaps, escalation chains, or confused-deputy paths exist. The ABI is the ten ERC-20 functions plus the supply constant.\n- The compiled runtime has no CALL, CREATE, DELEGATECALL, CALLCODE or SELFDESTRUCT opcodes outside push data. Native value and unknown selectors revert.\n- The approve/transferFrom pair is symmetric. A fuzz test confirmed transfer and transferFrom produce identical balances for the same inputs, with only the allowance differing.\n- I replayed both privileged-selector lists from the protected harness, from the factory and from a stranger. Every call reverts, supply stays fixed, and the factory cannot pull a holder's balance without approval.\n- The project's own 33 tests pass with the documented fuzz seed, and the formatter check passes.\n\n**The one finding (low):** the documented command `sha256sum --check DEPENDENCIES.sha256` fails on six forge-std files, contradicting the claim in SECURITY.md that every vendored file matched. I downloaded the pinned v1.9.6 archive and compared. The recorded checksums are the upstream bytes, and the tree's copies differ only in whitespace from a formatter. forge-std is test-only, so the deployed token is unaffected. The fix is to restore the upstream bytes or regenerate the checksum file and amend the docs.\n\n**Coverage record:** all three listed entry points are marked `holds`, plus rows for the constructor and role inventory, runtime bytecode, and the provenance finding. No area was left unreached.","treeHash":null,"usage":{"cachedInputTokens":967700,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":15535,"runtime":"claude","turns":30,"wallClockMs":220618}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"a4c81f495eb81dd0","findings":[{"citation":"resolved","description":"Outside the assigned math area; reported because it is verifiable and the documented integrity claim is false. DEPENDENCIES.md states every vendored file is an unmodified upstream file whose bytes are pinned by DEPENDENCIES.sha256. The pinned hashes are the genuine forge-std v1.9.6 hashes (confirmed against the upstream archive, whose SHA-256 53d2b498...7b1c6 matches the one documented), but six files in lib/forge-std/src were reformatted after vendoring (forge fmt with line_length 120 joined wrapped signatures), so their bytes no longer match: StdJson.sol, Vm.sol, interfaces/IMulticall3.sol, console.sol, StdAssertions.sol, StdToml.sol. A whitespace-insensitive diff (diff -wB) against upstream is empty for all six, so there is no semantic change and nothing in the deployed token is affected (forge-std is test-only). Impact is limited to the integrity statement being unverifiable as written: anyone running the documented check gets failures and cannot distinguish a formatting change from a tampered test library. Fix: either restore the six files byte-for-byte from the v1.9.6 archive, or regenerate DEPENDENCIES.sha256 and reword DEPENDENCIES.md to say the files were reformatted.","line":4,"path":"DEPENDENCIES.md","reproduction":"In the repository root run `sha256sum -c DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md): every line OK. Actual: six lines report FAILED (lib/forge-std/src/StdJson.sol, Vm.sol, interfaces/IMulticall3.sol, console.sol, StdAssertions.sol, StdToml.sol) and 'WARNING: 6 computed checksums did NOT match'. Downloading https://codeload.github.com/foundry-rs/forge-std/tar.gz/refs/tags/v1.9.6 and running `diff -wB` between each upstream file and the vendored file produces no output, while `cmp` reports they differ (e.g. Vm.sol at line 770, where a four-line wrapped signature was joined into one line). All OpenZeppelin files verify OK.","severity":"info","snippet":"as submodules. `DEPENDENCIES.sha256` pins each included file's bytes. Only the","title":"DEPENDENCIES.sha256 does not match six vendored forge-std files (whitespace-only reformat)"}],"hash":"d6d444435edbdde72c5c4a48ac499b2856d784ddd79212542e497433ba0925ab","nodeId":"61050a65-4df6-4f26-97ed-433eadb58fc9","outcome":"completed","summary":"The review is complete. The findings file is written and the working tree contains nothing outside the allowed paths. The build outputs in `out/` and `cache/` are gitignored and the scratch test directory was deleted.\n\n**Outcome:** no defect in the assigned area. The token is an unmodified OpenZeppelin v5.1.0 ERC20 with a single constructor mint of a compile-time constant, and it contains no division, rate math, scale conversion, downcast, external call, payable path or bytes decoding for the Math Precision, Boundary or Numerical Gap checklists to bite on.\n\n**What I verified**\n- **Supply constant.** One billion times ten to the eighteenth is exact and far below the uint256 and uint128 limits. It matches the manifest's total supply in minor units.\n- **Launch split arithmetic.** The ten percent swarm share and the eighty-eight percent pool share divide the supply with zero remainder, and the token moves exactly what is passed, so every launch flow arrives whole.\n- **Transfer, transferFrom, approve.** I traced the checked balance guard, the unchecked subtraction and addition that it makes safe, the infinite-allowance sentinel, and the address-zero reverts on both sides of each branch. Inputs of zero, one wei, the whole supply, the maximum uint256 and maximum minus one all behave as intended.\n- **Boundaries.** Sending ETH to the token with or without calldata reverts. There are no external calls or callbacks.\n- **Tests.** The project's own suite passes, including the 128-run invariant suite with revert-on-failure. My scratch boundary test of the edge numbers above also passed before I removed it.\n\n**One informational finding, outside my area.** Running the documented hash check fails for six forge-std files. The pinned hashes are the genuine v1.9.6 ones, but the vendored copies were reformatted after vendoring, so the integrity statement in DEPENDENCIES.md is false as written. A whitespace-insensitive diff against upstream is empty, so nothing semantic changed and the deployed token is unaffected. The fix is to restore the six files byte-for-byte or regenerate the hash file and reword the claim.\n\n**Coverage record.** All three listed entry points are marked as holding, with reasons, plus rows for the supply constant, the launch split arithmetic, the boundary enumeration, the numerical-gap seams, and the dependency integrity finding.","treeHash":null,"usage":{"cachedInputTokens":890751,"inputTokens":386,"model":"claude-fable-5-1","outputTokens":13089,"runtime":"claude","turns":28,"wallClockMs":209829}}],"verification":[{"checks":[{"durationMs":1321,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.25s\nCompiler run successful!\n","passed":true},{"durationMs":2246,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 1 test for test/LaunchTransfers.t.sol:LaunchTransfersTest\n[PASS] test_launchDistributionClaimsAndPoolTransfersArriveWhole() (gas: 691324)\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 793.36µs (631.54µs CPU time)\n\nRan 31 tests for test/POEDBToken.t.sol:POEDBTokenTest\n[PASS] testFuzz_approvedTransferFrom(uint256,uint256) (runs: 512, μ: 163255, ~: 165218)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639932\n  Bound result 15436314710528912123\n\n[PASS] testFuzz_selfTransferPreservesBalance(uint256) (runs: 512, μ: 55260, ~: 55009)\nLogs:\n  Bound result 4076725130\n\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 512, μ: 127519, ~: 127645)\nLogs:\n  Bound result 470054332889450\n  Bound result 1\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 512, μ: 92907, ~: 93344)\nLogs:\n  Bound result 10189023830762954892\n\n[PASS] testFuzz_transferFromAboveAllowanceReverts(uint256,uint256) (runs: 512, μ: 123598, ~: 123935)\nLogs:\n  Bound result 5000000000000000000\n  Bound result 999999995000000000000014416\n\n[PASS] test_allowancesAreIsolatedByOwnerAndSpender() (gas: 204100)\n[PASS] test_approvalCanBeReplacedAndRevoked() (gas: 167102)\n[PASS] test_approveEmitsEventAndDoesNotMoveTokens() (gas: 88798)\n[PASS] test_approveZeroSpenderReverts() (gas: 62241)\n[PASS] test_commonPrivilegedSelectorsRevertForDeployerAndStranger() (gas: 865885)\n[PASS] test_constructorEmitsExactlyOneMint() (gas: 9825)\n[PASS] test_create2DeploymentMintsOnlyToFactory() (gas: 345459)\n[PASS] test_deployerCannotSpendHolderTokensWithoutApproval() (gas: 95322)\n[PASS] test_directDeploymentMintsToItsCaller() (gas: 28271)\n[PASS] test_entireSupplyCanMoveAndMoveBack() (gas: 147238)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 204288)\n[PASS] test_metadataAndInitialSupply() (gas: 108539)\n[PASS] test_nativeCurrencyAndUnknownCallsRevert() (gas: 58911)\n[PASS] test_transferDoesNotInvokeRecipient() (gas: 170385)\n[PASS] test_transferEmitsEventAndMovesExactAmount() (gas: 91603)\n[PASS] test_transferFromConsumesAllowanceAndEmitsTransfer() (gas: 214744)\n[PASS] test_transferFromEmptyAccountReverts() (gas: 45209)\n[PASS] test_transferFromFailureRestoresAllowanceAndBalances() (gas: 189083)\n[PASS] test_transferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 103196)\n[PASS] test_transferFromToZeroRestoresAllowance() (gas: 114284)\n[PASS] test_transferFromZeroAddressReverts() (gas: 54823)\n[PASS] test_transferMaximumUintRevertsWithoutOverflow() (gas: 55391)\n[PASS] test_transferToZeroRevertsEvenForZeroAmount() (gas: 72283)\n[PASS] test_unapprovedSpenderCannotTransferFrom() (gas: 120131)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73428)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 78735)\nSuite result: ok. 31 passed; 0 failed; 0 skipped; finished in 18.21ms (90.20ms CPU time)\n\nRan 1 test for test/POEDBToken.invariant.t.sol:POEDBTokenInvariantTest\n[PASS] invariant_supplyBalancesAndAllowancesMatchAccounting() (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+-----------------------+-------+---------+----------╮\n| Contract     | Selector              | Calls | Reverts | Discards |\n+===================================================================+\n| POEDBHandler | approve               | 1626  | 0       | 0        |\n|--------------+-----------------------+-------+---------+----------|\n| POEDBHandler | rejectOverspend       | 1703  | 0       | 0        |\n|--------------+-----------------------+-------+---------+----------|\n| POEDBHandler | rejectUnapprovedSpend | 1651  | 0       | 0        |\n|--------------+-----------------------+-------+---------+----------|\n| POEDBHandler | transfer              | 1628  | 0       | 0        |\n|--------------+-----------------------+-------+---------+----------|\n| POEDBHandler | transferFrom          | 1584  | 0       | 0        |\n╰--------------+-----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 414978639925180857814555682\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 6299\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1674\n  Bound result 1900\n  Bound result 2924\n  Bound result 431543315457578185886836931\n  Bound result 0\n  Bound result 0\n  Bound result 10000000000000000000\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.16s (2.16s CPU time)\n\nRan 3 test suites in 2.16s (2.18s CPU time): 33 tests passed, 0 failed, 0 skipped (33 total tests)\n","passed":true},{"durationMs":36,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"POEDBToken.approve(address,uint256)\",\"POEDBToken.transfer(address,uint256)\",\"POEDBToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":27,\"DEPENDENCIES.sha256\":32,\"README.md\":147,\"SECURITY.md\":38,\"foundry.toml\":21,\"remappings.txt\":2,\"src/POEDBToken.sol\":17,\"test/LaunchTransfers.t.sol\":50,\"test/POEDBToken.invariant.t.sol\":116,\"test/POEDBToken.t.sol\":375,\"test/helpers/TokenFactory.sol\":25},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":576,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":290,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/POEDBToken.sol:12: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"30709744e20de9c0b9d9ba5199c91effd04a1493094744ba081fa13b142f7595","verifiedTreeHash":"df34cb30ee794ec4dbf7d98e3f9578c6fa43184c","verifierVersion":"0.1.0+aca6c688"},{"checks":[{"durationMs":3273,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 3.09s\nCompiler run successful!\n","passed":true},{"durationMs":4729,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 1 test for test/LaunchTransfers.t.sol:LaunchTransfersTest\n[PASS] test_launchDistributionClaimsAndPoolTransfersArriveWhole() (gas: 691324)\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.30ms (2.87ms CPU time)\n\nRan 31 tests for test/POEDBToken.t.sol:POEDBTokenTest\n[PASS] testFuzz_approvedTransferFrom(uint256,uint256) (runs: 512, μ: 163255, ~: 165218)\nLogs:\n  Bound result 14\n  Bound result 5\n\n[PASS] testFuzz_selfTransferPreservesBalance(uint256) (runs: 512, μ: 55260, ~: 55009)\nLogs:\n  Bound result 930729993677996218864957\n\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 512, μ: 127519, ~: 127645)\nLogs:\n  Bound result 5000000000000000000\n  Bound result 14416\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 512, μ: 92907, ~: 93344)\nLogs:\n  Bound result 9\n\n[PASS] testFuzz_transferFromAboveAllowanceReverts(uint256,uint256) (runs: 512, μ: 123598, ~: 123935)\nLogs:\n  Bound result 470054332889450\n  Bound result 470054332889452\n\n[PASS] test_allowancesAreIsolatedByOwnerAndSpender() (gas: 204100)\n[PASS] test_approvalCanBeReplacedAndRevoked() (gas: 167102)\n[PASS] test_approveEmitsEventAndDoesNotMoveTokens() (gas: 88798)\n[PASS] test_approveZeroSpenderReverts() (gas: 62241)\n[PASS] test_commonPrivilegedSelectorsRevertForDeployerAndStranger() (gas: 865885)\n[PASS] test_constructorEmitsExactlyOneMint() (gas: 9825)\n[PASS] test_create2DeploymentMintsOnlyToFactory() (gas: 345459)\n[PASS] test_deployerCannotSpendHolderTokensWithoutApproval() (gas: 95322)\n[PASS] test_directDeploymentMintsToItsCaller() (gas: 28271)\n[PASS] test_entireSupplyCanMoveAndMoveBack() (gas: 147238)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 204288)\n[PASS] test_metadataAndInitialSupply() (gas: 108539)\n[PASS] test_nativeCurrencyAndUnknownCallsRevert() (gas: 58911)\n[PASS] test_transferDoesNotInvokeRecipient() (gas: 170385)\n[PASS] test_transferEmitsEventAndMovesExactAmount() (gas: 91603)\n[PASS] test_transferFromConsumesAllowanceAndEmitsTransfer() (gas: 214744)\n[PASS] test_transferFromEmptyAccountReverts() (gas: 45209)\n[PASS] test_transferFromFailureRestoresAllowanceAndBalances() (gas: 189083)\n[PASS] test_transferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 103196)\n[PASS] test_transferFromToZeroRestoresAllowance() (gas: 114284)\n[PASS] test_transferFromZeroAddressReverts() (gas: 54823)\n[PASS] test_transferMaximumUintRevertsWithoutOverflow() (gas: 55391)\n[PASS] test_transferToZeroRevertsEvenForZeroAmount() (gas: 72283)\n[PASS] test_unapprovedSpenderCannotTransferFrom() (gas: 120131)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73428)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 78735)\nSuite result: ok. 31 passed; 0 failed; 0 skipped; finished in 81.31ms (260.08ms CPU time)\n\nRan 1 test for test/POEDBToken.invariant.t.sol:POEDBTokenInvariantTest\n[PASS] invariant_supplyBalancesAndAllowancesMatchAccounting() (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+-----------------------+-------+---------+----------╮\n| Contract     | Selector              | Calls | Reverts | Discards |\n+===================================================================+\n| POEDBHandler | approve               | 1626  | 0       | 0        |\n|--------------+-----------------------+-------+---------+----------|\n| POEDBHandler | rejectOverspend       | 1703  | 0       | 0        |\n|--------------+-----------------------+-------+---------+----------|\n| POEDBHandler | rejectUnapprovedSpend | 1651  | 0       | 0        |\n|--------------+-----------------------+-------+---------+----------|\n| POEDBHandler | transfer              | 1628  | 0       | 0        |\n|--------------+-----------------------+-------+---------+----------|\n| POEDBHandler | transferFrom          | 1584  | 0       | 0        |\n╰--------------+-----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 414978639925180857814555682\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 6299\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1674\n  Bound result 0\n  Bound result 2924\n  Bound result 158864562854982526766261131\n  Bound result 0\n  Bound result 0\n  Bound result 10000000000000000000\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 4.48s (4.48s CPU time)\n\nRan 3 test suites in 4.49s (4.56s CPU time): 33 tests passed, 0 failed, 0 skipped (33 total tests)\n","passed":true},{"durationMs":109,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"POEDBToken.approve(address,uint256)\",\"POEDBToken.transfer(address,uint256)\",\"POEDBToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":27,\"DEPENDENCIES.sha256\":32,\"README.md\":147,\"SECURITY.md\":38,\"foundry.toml\":21,\"launch.json\":24,\"remappings.txt\":2,\"src/POEDBToken.sol\":17,\"test/LaunchTransfers.t.sol\":50,\"test/POEDBToken.invariant.t.sol\":116,\"test/POEDBToken.t.sol\":375,\"test/helpers/TokenFactory.sol\":25},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"8e31f1eb58cc7371a55d246e19ef43dd4ce7ee9d4f666a8438f6a28df8eae83b","verifiedTreeHash":"ad229da0d61c9f3cbbad34a739680d6f222e2f5e","verifierVersion":"0.1.0+aca6c688"},{"checks":[{"durationMs":2185,"exitCode":0,"name":"build","output":"Compiling 32 files with Solc 0.8.26\nSolc 0.8.26 finished in 2.11s\nCompiler run successful!\n","passed":true},{"durationMs":9671,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 1 test for test/LaunchTransfers.t.sol:LaunchTransfersTest\n[PASS] test_launchDistributionClaimsAndPoolTransfersArriveWhole() (gas: 691324)\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 714.44µs (544.57µs CPU time)\n\nRan 11 tests for test/LaunchFlow.t.sol:LaunchFlowTest\n[PASS] testFuzz_launchSplitIsExactForAnyPoolShare(uint256) (runs: 1000, μ: 154921, ~: 155718)\nLogs:\n  Bound result 567\n\n[PASS] testFuzz_tradesThroughThePoolManagerConserveSupply(uint256,uint256) (runs: 1000, μ: 258910, ~: 259429)\nLogs:\n  Bound result 158142057896810006567955697\n  Bound result 153470886558917593274931727\n\n[PASS] test_claimsSplitTheSwarmShareWithoutLoss() (gas: 685008)\n[PASS] test_launchAddressesHaveNoPowerOverHolders() (gas: 285563)\n[PASS] test_neitherTheFactoryCallerNorTheOriginReceivesAnything() (gas: 138600)\n[PASS] test_oneTransactionLaunchSplitsTheSupplyExactly() (gas: 176925)\n[PASS] test_overAllocatedPlanRevertsAndDeploysNothing() (gas: 70259)\n[PASS] test_overspendingLaunchRevertsAndDeploysNothing() (gas: 149210)\n[PASS] test_poolManagerCannotMoveMoreThanItHolds() (gas: 142215)\n[PASS] test_poolManagerSellsAndBuysBackExactAmounts() (gas: 290935)\n[PASS] test_strangerCannotDriveTheLaunchFixture() (gas: 41573)\nSuite result: ok. 11 passed; 0 failed; 0 skipped; finished in 92.37ms (157.50ms CPU time)\n\nRan 31 tests for test/POEDBToken.t.sol:POEDBTokenTest\n[PASS] testFuzz_approvedTransferFrom(uint256,uint256) (runs: 512, μ: 163678, ~: 165206)\nLogs:\n  Bound result 5000000000000000000\n  Bound result 14416\n\n[PASS] testFuzz_selfTransferPreservesBalance(uint256) (runs: 512, μ: 55258, ~: 55009)\nLogs:\n  Bound result 4076725130\n\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 512, μ: 127568, ~: 127627)\nLogs:\n  Bound result 999999999999999999999999997\n  Bound result 15436314710528912123\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 512, μ: 92928, ~: 93344)\nLogs:\n  Bound result 454855611873337130175895799\n\n[PASS] testFuzz_transferFromAboveAllowanceReverts(uint256,uint256) (runs: 512, μ: 123696, ~: 123947)\nLogs:\n  Bound result 5000000000000000000\n  Bound result 999999995000000000000014416\n\n[PASS] test_allowancesAreIsolatedByOwnerAndSpender() (gas: 204100)\n[PASS] test_approvalCanBeReplacedAndRevoked() (gas: 167102)\n[PASS] test_approveEmitsEventAndDoesNotMoveTokens() (gas: 88798)\n[PASS] test_approveZeroSpenderReverts() (gas: 62241)\n[PASS] test_commonPrivilegedSelectorsRevertForDeployerAndStranger() (gas: 865885)\n[PASS] test_constructorEmitsExactlyOneMint() (gas: 9825)\n[PASS] test_create2DeploymentMintsOnlyToFactory() (gas: 345459)\n[PASS] test_deployerCannotSpendHolderTokensWithoutApproval() (gas: 95322)\n[PASS] test_directDeploymentMintsToItsCaller() (gas: 28271)\n[PASS] test_entireSupplyCanMoveAndMoveBack() (gas: 147238)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 204288)\n[PASS] test_metadataAndInitialSupply() (gas: 108539)\n[PASS] test_nativeCurrencyAndUnknownCallsRevert() (gas: 58911)\n[PASS] test_transferDoesNotInvokeRecipient() (gas: 170385)\n[PASS] test_transferEmitsEventAndMovesExactAmount() (gas: 91603)\n[PASS] test_transferFromConsumesAllowanceAndEmitsTransfer() (gas: 214744)\n[PASS] test_transferFromEmptyAccountReverts() (gas: 45209)\n[PASS] test_transferFromFailureRestoresAllowanceAndBalances() (gas: 189083)\n[PASS] test_transferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 103196)\n[PASS] test_transferFromToZeroRestoresAllowance() (gas: 114284)\n[PASS] test_transferFromZeroAddressReverts() (gas: 54823)\n[PASS] test_transferMaximumUintRevertsWithoutOverflow() (gas: 55391)\n[PASS] test_transferToZeroRevertsEvenForZeroAmount() (gas: 72283)\n[PASS] test_unapprovedSpenderCannotTransferFrom() (gas: 120131)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73428)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 78735)\nSuite result: ok. 31 passed; 0 failed; 0 skipped; finished in 92.51ms (428.18ms CPU time)\n\nRan 21 tests for test/POEDBToken.edges.t.sol:POEDBTokenEdgesTest\n[PASS] testFuzz_approveReplacesRatherThanAccumulates(uint256,uint256) (runs: 1000, μ: 131672, ~: 131762)\n[PASS] testFuzz_balancesNeverExceedSupply(address,address,uint256,uint256) (runs: 1000, μ: 183001, ~: 184346)\nLogs:\n  Bound result 16794\n  Bound result 8428\n\n[PASS] testFuzz_chainedTransfersConserveSupply(uint8,uint256) (runs: 1000, μ: 475012, ~: 396960)\nLogs:\n  Bound result 4\n  Bound result 789844010636844745289550402\n  Bound result 263162744967003555354556091\n  Bound result 60798415029595486868149376\n  Bound result 28419741520611779020293703\n\n[PASS] testFuzz_twoSpendersShareOneBalance(uint256,uint256,uint256) (runs: 1000, μ: 364140, ~: 369248)\nLogs:\n  Bound result 5\n  Bound result 5\n  Bound result 3\n\n[PASS] testFuzz_unimplementedSelectorsRevertAndChangeNothing(bytes4,bytes,uint96) (runs: 1000, μ: 146572, ~: 146137)\n[PASS] test_allowanceOneBelowAmountRevertsAndExactAmountSucceeds() (gas: 270389)\n[PASS] test_approveFromZeroAddressReverts() (gas: 40623)\n[PASS] test_balanceOneBelowAmountRevertsEvenWithAllowance() (gas: 166151)\n[PASS] test_constructorRejectsNativeValue() (gas: 1430918)\n[PASS] test_implementedSelectorsRejectValue() (gas: 180697)\n[PASS] test_infiniteAllowanceStillRequiresBalance() (gas: 163343)\n[PASS] test_maxAllowanceMinusOneIsFiniteAndDecrements() (gas: 124021)\n[PASS] test_mutatingCallsReturnExactlyOneTrueWord() (gas: 263640)\n[PASS] test_oneUnitTransferAndExactBoundaries() (gas: 176161)\n[PASS] test_ownerCanApproveSelfAndSpendThroughTransferFrom() (gas: 162282)\n[PASS] test_runtimeFitsEip170AndHasNoDelegatecallCallcodeOrSelfdestruct() (gas: 2500530)\n[PASS] test_runtimeIsIdenticalAcrossDeployments() (gas: 57366)\n[PASS] test_spenderAllowanceDoesNotSurviveOwnerBalanceExhaustion() (gas: 278318)\n[PASS] test_transferFromEmitsOnlyTransfer() (gas: 129719)\n[PASS] test_transferFromZeroAddressWithAmountRevertsOnAllowance() (gas: 55691)\n[PASS] test_viewCallsReturnWellFormedData() (gas: 49108)\nSuite result: ok. 21 passed; 0 failed; 0 skipped; finished in 93.46ms (435.53ms CPU time)\n\nRan 1 test for test/POEDBToken.invariant.t.sol:POEDBTokenInvariantTest\n[PASS] invariant_supplyBalancesAndAllowancesMatchAccounting() (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+-----------------------+-------+---------+----------╮\n| Contract     | Selector              | Calls | Reverts | Discards |\n+===================================================================+\n| POEDBHandler | approve               | 1626  | 0       | 0        |\n|--------------+-----------------------+-------+---------+----------|\n| POEDBHandler | rejectOverspend       | 1703  | 0       | 0        |\n|--------------+-----------------------+-------+---------+----------|\n| POEDBHandler | rejectUnapprovedSpend | 1651  | 0       | 0        |\n|--------------+-----------------------+-------+---------+----------|\n| POEDBHandler | transfer              | 1628  | 0       | 0        |\n|--------------+-----------------------+-------+---------+----------|\n| POEDBHandler | transferFrom          | 1584  | 0       | 0        |\n╰--------------+-----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 140\n  Bound result 56\n  Bound result 0\n  Bound result 414978639925180857814555682\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 6301\n  Bound result 0\n  Bound result 2\n  Bound result 12\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 401405137538343928826141711\n  Bound result 0\n  Bound result 33\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.13s (2.13s CPU time)\n\nRan 1 test for test/POEDBToken.open.invariant.t.sol:POEDBTokenOpenInvariantTest\n[PASS]\nPOEDBTokenOpenInvariantTest invariants:\n[PASS] invariant_actorsAndSinksAccountForTheWholeSupply\n[PASS] invariant_allowancesMatchTheGhostLedger\n[PASS] invariant_balancesMatchTheGhostLedger\n[PASS] invariant_movedVolumeIsBoundedBySuccessfulCalls\n[PASS] invariant_refusalsWereExercised\n[PASS] invariant_sinksOnlyGrow\n[PASS] invariant_totalSupplyIsConstant\n POEDBTokenOpenInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭-------------+-------------------------------------+-------+---------+----------╮\n| Contract    | Selector                            | Calls | Reverts | Discards |\n+================================================================================+\n| OpenHandler | approve                             | 1490  | 0       | 0        |\n|-------------+-------------------------------------+-------+---------+----------|\n| OpenHandler | refuseApproveZeroSpender            | 1484  | 0       | 0        |\n|-------------+-------------------------------------+-------+---------+----------|\n| OpenHandler | refuseBalanceShortfallWithAllowance | 1499  | 0       | 0        |\n|-------------+-------------------------------------+-------+---------+----------|\n| OpenHandler | refuseMintAndBurn                   | 1524  | 0       | 0        |\n|-------------+-------------------------------------+-------+---------+----------|\n| OpenHandler | refuseOverAllowance                 | 1542  | 0       | 0        |\n|-------------+-------------------------------------+-------+---------+----------|\n| OpenHandler | refuseOverspend                     | 1508  | 0       | 0        |\n|-------------+-------------------------------------+-------+---------+----------|\n| OpenHandler | refuseSpendingFromSinks             | 1501  | 0       | 0        |\n|-------------+-------------------------------------+-------+---------+----------|\n| OpenHandler | refuseTransferToZero                | 1452  | 0       | 0        |\n|-------------+-------------------------------------+-------+---------+----------|\n| OpenHandler | transfer                            | 1484  | 0       | 0        |\n|-------------+-------------------------------------+-------+---------+----------|\n| OpenHandler | transferFrom                        | 1425  | 0       | 0        |\n|-------------+-------------------------------------+-------+---------+----------|\n| OpenHandler | transferToSink                      | 1475  | 0       | 0        |\n╰-------------+-------------------------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 123\n  Bound result 3\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 6\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 7264\n  Bound result 16\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129647319\n  Bound result 6000000000000000000\n  Bound result 0\n  Bound result 64\n  Bound result 0\n  Bound result 127\n  Bound result 2591\n  Bound result 12\n  Bound result 10000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 5000000000000000000\n  Bound result 254\n  Bound result 5965\n  Bound result 281\n  Bound result 1\n  Bound result 3124842407\n  Bound result 9\n  Bound result 0\n  Bound result 8278\n  Bound result 10000\n  Bound result 0\n  Bound result 8396\n  Bound result 1098\n  Bound result 13\n  Bound result 8266\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 9.59s (9.59s CPU time)\n\nRan 6 test suites in 9.59s (12.00s CPU time): 66 tests passed, 0 failed, 0 skipped (66 total tests)\n","passed":true},{"durationMs":34,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"POEDBToken.approve(address,uint256)\",\"POEDBToken.transfer(address,uint256)\",\"POEDBToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":27,\"DEPENDENCIES.sha256\":32,\"README.md\":147,\"SECURITY.md\":38,\"foundry.toml\":21,\"remappings.txt\":2,\"src/POEDBToken.sol\":17,\"test/LaunchFlow.t.sol\":221,\"test/LaunchTransfers.t.sol\":50,\"test/POEDBToken.edges.t.sol\":382,\"test/POEDBToken.invariant.t.sol\":116,\"test/POEDBToken.open.invariant.t.sol\":300,\"test/POEDBToken.t.sol\":375,\"test/helpers/LaunchSimulator.sol\":76,\"test/helpers/TokenFactory.sol\":25},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"c393b7b880af5b8a630638957dd0a0c7d47e278edabc19479118593e8f4ee6d9","verifiedTreeHash":"f1766a1b9215fcc1fb31fd5826bec6158ef209c3","verifierVersion":"0.1.0+aca6c688"}]}